Closed source projects are also subject to bullying.

Project managers pressuring developers to implement half assed features in an afternoon because sales sold a feature that doesn’t exist and have signed a deal to have it delivered tomorrow morning. Who has time to review the code and ensure there are no SQL injection vulnerabilities? Just push it!

Three years ago, #FDroid had a similar kind of attempt as the #xz #backdoor. A new contributor submitted a merge request to improve the search, which was oft requested but the maintainers hadn't found time to work on. There was also pressure from other random accounts to merge it. In the end, it became clear that it added a #SQLinjection #vuln. In this case, we managed to catch it before it was merged. Since similar tactics were used, I think its relevant now

https://social.librem.one/@eighthave/112194828562355097

Steiner wrote this week that the original coder deleted their account as soon as F-Droid’s maintainers attempted to review the code, and that he thinks that the user’s behavior, as well as “all the attention from random new accounts” has led him to believe “it could be a deliberate attempt to insert the vuln.”

This is pretty significant: the first documented case of these tactics being used to insert a vulnerability, apart from xz. So probably the same actors have been trying this on multiple projects.

I hope other maintainers who have experienced similar pressure tactics will come forward, even if they're not aware of any backdoors. For any project where this has taken place and the code was merged, the code and commit history needs to be audited.

Thats like "child labor is bad because they cant do high quality work".

Bullying is bad. Period.

Bullying in Closed Source Software is also bad. Off course in Open Source more people have the ability to do this, compared to a more controlled environment like Closed Source. What do we learn from the mistakes described in the article? Don't close your eyes, watch and don't trust untrusted people. If someone starts bullying or is toxic, take that as an attack and warn them to get banned. It's like saying bullying under politicians is bad. Yes it is. And we should not allow that. But that does not mean we should stop using or developing Open Source (or stop electing).

If people are really unhappy with the direction of the project and if they want to push specific updates they want see, they should just fork it and do whatever they want. And if it works, it can still be integrated into the "main app".

People will always be a vulnerability. That goes for physical security too.

Im a former contributor to F-Droid with various merged pull requests. Looking at the indicated pull request I really doubt that it was an intentional attack. First of all its easy to forget for a new developer to escape SQL parameters, and the docs dont even mention a risk of SQL injection attacks. And of the users pushing for the PR to be merged, one is a long-time F-Droid contributor, and the other also looks like a real human with many contributions in other repos, so no sockpuppets in sight.

It simply looks like standard open source behaviour, for better or for worse. A new user makes a contribution for a highly demanded feature, and users want it to get merged as soon as possible. Maintainers are discussing the big picture of the change and want to avoid breaking changes, without getting into code review yet. The new contributor seems unwilling to make any design changes to his PR, and gets frustrated that it doesnt get merged as is. The potential vulnerability is only noticed half a year after the PR was opened, at which point it was already de facto abandoned. So not an attack, but simply a developer who is new to open source and doesnt understand how the process works.

This is why I dislike people badgering the Lemmy devs for whatever they feel is currently important to them. "Ermagerd, it's GDPR violation!!!1!!!1!!111". Or people flaming the developer(s) of Mastodon for not implementing quoting "Twitter has it, so you must implement it for people coming from Twitter!". And so on and so forth.

We should all be doing what we can to help opensource developers and that also means calling out shitty behavior from its users or external contributors towards maintainers. Maintainers aren't messiahs and just humans too, so them being cunts isn't nice either (obviously), but I have much more understanding for their behavior sometimes. Especially when hundreds of entitled keyboard warriors attack maintainers and write blog articles about them (like wedistribute.org) demanding stuff be done their way.

Maintainers also need better tools and features from giants like github to shutdown annoying users on their projects. Github's "social" features need a lot of work. It's not possible to have moderators (human or automatic provided by the platform) for projects for example. Instead maintainers have to read all the bullshit demands people have expressed with no filter.

When the maintainer of actix stepped down due to harrassment by rust purists (he used the unsafe keyword) and there was an outpour of support, it felt so ridiculously fake. It had been going on for a while and there were reddit threads, blog posts, tweets, and other cries on social media by the purists that amounted to harrassment, but only when the maintainer stepped down did people affected react.

I'm by far no angel, but at least my claim to fame isn't abusing maintainers enough for them to quit.

CC BY-NC-SA 4.0

If something is free Software, there is no supply chain. There is no security and no guarantees. For sure all these volunteers are mostly trying to deliver a good product, but they are offering free labor.

Saying "bullying is bad for the outcome of the product" is kinda ironic, as "not paying these devs" also is bad. This is just the extreme form

So what is the the solution then? What kind of culture would be more operationally secure?

My hair stood up straight due to an ad on that website playing music.. A blast from the past!

I had a project I gave up and dropped because of the general OSS community being crap.

There were a lot of supporters, but got tired of all the wankers I had to defend the project from. It simply wasn't worth it when I was putting in so much time for free

So, I agree entirely.

It's not everyone, but we do have a lot of donkeys out there honestly, and i suspect it has a bigger impact on the development community than we know